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Introduction 


ITV welcomes the opportunity to respond to the ICO’s consultation on a new age 
appropriate by design code. As a commercially funded public service broadcaster, ITV 
makes a major contribution to UK television - providing national and regional news, and 
entertainment, including drama and sport. We invest around £1bn in programmes every 
year in one of the most competitive and successful audiovisual markets in the world. In 
addition to delivering our content through linear television - with our 6 digital channels 
- we provide on-demand services via the ITV Hub (which is a free to air ad-funded) and 
ITV Hub+ (which allows consumers to pay for content without the ads). We are also 
looking to roll-out a new subscription service - Britbox - which will be a UK-based pay 
streaming service providing access to the best of British content. 


ITV is committed to protecting children off and online and we take child protection 
seriously on our on-demand services. To that end: 

e the content we offer on our services - both the editorial content and the 
advertising content - is under our control and is subject to rigorous compliance 
processes to ensure its suitability; 

e all our content shown on the ITV Hub adheres to the strictest standards of the 
Broadcast Code for linear TV services set by Ofcom; 

e in trying to balance the ethos of universal availability of Public Service 
Broadcasting (PSB) content along with compliance with the CAP code and 
GDPR, we have set access to the ITV Hub at 16+ through our registration 
system; 

e while access to most of our content requires a user to register, we deliver access 
for children to watch child content (e.g. CITV) on the Hub without any 
registration (and hence no provision of any data). Any attempt made by the 
child to then access other content triggers a request to register; 

e we do not cross promote non-child content on the Hub around CITV content; 

e we have put in place parental tools to help users make informed and 
appropriate choices, for example G for Guidance rating, with accompanying 
programme information and parental lock through pin protection to ensure that 
the registered profile user can put in place these additional safeguards against 
children accessing inappropriate content via that account. 


With respect to data, GDPR compliance and our audiences’ trust in how we use their 
data is extremely important to us. We collect minimal data from our users at the point of 
registration (data consists of name, date of birth, email and postcode), offer 
transparency around how we collect further data and how we use or augment data used 
in the functioning of our service. Furthermore, we provide easily comprehensible 
control over personalisation of our service, allowing users to opt-out of and change 
personalisation at any time. 


However, we recognise that whilst we place enormous emphasis on providing a trusted 
and safe space for our users to enjoy high-quality content, this is not necessarily the case 
for all online service providers. In a globalised and highly competitive environment, the 
race to collect, use and monetise data in some way is of real concern. Increasingly 


children have access to a myriad of online services on platforms where, as big data 
harvesters, they do not always have the best interests of the child and indeed their users 
at heart. 


Given these problems, it is right that the ICO is concerned about how data is being used 
and that it wants to act to ensure that children are protected online. However, we do not 
believe that the code as currently drafted will solve this problem. The key problem with 
the draft code is that it seeks to impose a “one size fits all mechanism” - “child- 
appropriate by default” - onto all online services irrespective of the type of service 
offered, the expected audience for that service, the sorts of harms children may be 
exposed to on that service and the scale and usage of data collected by the online 
platforms. 


Accordingly, the draft code is a blunt instrument which crucially makes no 
differentiation between services where the content is controlled by the service provider 
and subject to a demanding existing regulatory regime and services which are 
unregulated and have little or no control over much of the content on their services. 
These are fundamental differences, which require a more differentiated policy 
approach. 


In taking this approach, the draft code also fails to: 

e focus on the most egregious harms children may be exposed to, ignoring 
current protections in place to help inform, guide and educate children and 
parents more generally online (as well as cutting across efforts around media 
literacy). 

e set out an effective way to protect children online. In presenting a binary choice 
(making a service child appropriate by default or introducing robust age 
verification), many online service providers will simply deny children access to 
a whole host of online services, content and information, thereby excluding 
them from all sorts of activities that help children learn, develop and explore 
their environment both on and offline (essentially age-gating large swathes of 
the internet). 

e take account of the types of service and nature of the data being collected. For 
example, at the moment we allow all users, including children to access our 
CITV content without registration, providing a safe, secure and non-data 
intrusive way for children to access our children’s content. For non-registered 
users we do not collect personal data (bar IP addresses which we do not link 
back to a user in anyway) but do collect standard analytic data for the purpose 
of running the service (e.g. to see how users overall are using our services so we 
can improve them). 

e recognise that in trying to treat all online services the same, the draft code’s 
practical impact will vary significantly depending on the type of service and 
content offered, how a service is funded (ad funded or subscription) and the 
ease in which users can find a comparable service or same content elsewhere. 


The proposed code will also have the unintended consequence of seriously distorting 
competition unless the ICO adopts a more differentiated policy approach in this code. 
Without this, the danger is that a whole host of ad-funded services - including those 
associated with free to air broadcasting - will be adversely impacted. Given the direct 
and associated costs (and lost revenue) of compliance with this draft code, the 
percentage of our online revenue that would be lost (as a much smaller online targeted 
advertising platform) will be far greater than for the dominant, global incumbents. In 
other words, there is also a serious risk that this regulation will entrench the position of 


global tech companies and disadvantage smaller potential challengers. Moreover, if 
credit cards are seen as a viable form of robust verification, this draft code will skew the 
market in favour of paid services who will have to do very little to comply with the code 
compared to free ad-funded PSB services. 


We therefore urge the ICO to revisit this draft code, not least to make sure it constitutes 
a proportionate response to addressing children’s privacy and data protection online. 
To be clear we are not, in any way, trying to set out arguments that will allow businesses 
to avoid their obligations to protect children’s privacy or to monetise their data. 
However, we need a proportionate code that sets out a risk-based approach working in 
concert with other regulatory regimes as well as recognising potentially competing 
policy objectives (e.g. around safeguarding PSB’s). Indeed, we consider that in 
complying with the GDPR, responsible service providers should already be following a 
proportionate approach with the principles of privacy by design, the reference to 
specific protection for children and the use of data protection impact assessments and 
legitimate interest assessments. We have carried out DPIAs and LIAs across a variety of 
different processing activities. Carrying out these assessments require us to take 
account of the nature of the data, the nature of the processing and balance our interests 
with those of the data subjects. We have taken these factors into account in 
implementing a dual approach on the ITV Hub where children’s content is accessible 
without registration and registration is aimed at those aged 16 or over with all the 
measures outlined above as additional protection in connection with the content (for 
example, the “G” guidance and parental lock). 


ITV online service and use of data 


Audiences come to ITV wanting frictionless and free access to high-quality content - the 
online equivalent of our free to air TV service. We generate trusted news that informs 
democracy in an era of widespread misinformation and disinformation; our original 
programming helps define our national culture at a time of concerns around impact of 
globalisation; and the creative sector’s overall importance is fundamental to the UK’s 
economic growth and international influence. 


So that as many people as possible can access and enjoy our content we want the 
consumer experience on our online service to be as close as we can make it to free to air 
television. In other words, we want access to be as easy and seamless as possible. This 
ease of access is key to helping our PSB system thrive, with content and services that 
will appeal to a wide audience, serving the needs of a diverse society. 


In adapting our services for the online world however, we also have to meet obligations 
to our rightsholders, licensees and Channel 3 networking arrangements which tend to 
require geographical restrictions on our services - for example, we use postcode and 
location data to ensure that ITV main channel content is regionalised. As well as helping 
us meet these obligations, we use the data collected on registration to provide our users 
with a service which is more relevant to them both in terms of editorial content 
(including content recommendations and functionalities such as pausing a programme 
to watch later on) and advertising. However, we also recognise the need and desire of 
consumers to have control over their data for certain activities (like personalisation of 
content and targeted advertising) and, as such, users are signposted to a set of simple 
and easy to use options to change their personalisation settings. This approach has 
benefits both in terms of a more personal user experience in line with what users have 
come to expect from online services and enables us to maintain our competitiveness 
commercially as advertising clients expect to be able to deliver advertising as efficiently 
as possible to their key audiences. 


Unlike most online services where ads merely exist to fund that experience, ads shown 
on our catch-up services are also central to our ability to reinvest in high-quality PSB 
content that audiences want to see. No ads mean no programmes (for both our linear 
channels and for online). Being able to maintain our ability to provide a service which is 
attractive to advertisers ultimately allows us to recoup money So we can continue to 
reinvest the £1bn a year we put into making content, including our news services. 


In addition to sharing the same objective around frictionless access, from an editorial 
perspective, we ensure that all our content on the ITV Hub meets the standard applied 
to linear broadcast and is compliant with Ofcom’s Broadcasting Code as well as the rules 
for on-demand programme services. This ensures that all our programmes abide by a 
range of detailed rules - covering areas such as crime, sex, drugs, language, violence and 
self-harm etc. Clearly, a lot of the content available on the open internet would never be 
permitted on ITV, an Ofcom licensed service. 


Specific to children, we recognise that ITV Hub is a mixed space offering a variety of 
content including children’s content (through CITV). We actively take a different 
approach on children’s content in respect of data as access to CITV content is not 
dependent on registering on the Hub. There are also additional content protections in 
place for CITV content in that any advertising shown around children’s content is purely 
contextual, has been viewed by the ITV team in advance of distribution and is not 
targeted to an individual in any way. In the event that a child after watching CITV tries 
to access other content on the Hub this would trigger a registration request (where 
users have to input a data of birth to confirm they are 16 or older). We also have in place 
a set of protections to ensure that children are guided away from inappropriate content, 
for example through the G for Guidance scheme which provides a parental lock / PIN 
control as well as programme information to help parents make informed choices. This 
scheme was devised in collaboration with Ofcom and is a widely used/recognisable 
scheme available on all PSB online services. 


Through compliance with GDPR, the Broadcasting Code and the ASA CAP code, 
designing our service to ensure that children can access children’s content (CITV) 
without registration yet at the same time providing a range of parental safeguards, we 
believe ITV provides a frictionless, trusted space for all our users online. Indeed, we 
have looked at our customer contacts over the last 12 months and we have not received 
any queries which suggest any concern about children’s data or children’s access to 
post-watershed content. We have received contacts related to PIN control where users 
had forgotten their PIN code or set up the parental lock in error or needed to reset their 
PIN (often due to iOS software updates which resets user profiles). 


As well as the efforts we undertake on our own service to protect children’s privacy and 
data, we also work with third party platforms on which we operate, who may have 
complementary and additional safeguards. An example of this is Apple where the ITV 
Hub app on iOS has to select one of the following age categorisations - +4, +9, +12 and 
+17 years of age. Given these settings, and because the ITV Hub app on iOS contains 
mixed content, we have taken the safest approach (from an access to content point of 
view) and set the age bar high (17+), rising from the 16+ settings at set out in ITV Hub’s 
terms and conditions. This means that if parents have set age access restrictions on the 
relevant iOS devices at lower than 17 years of age, then it will not be possible to 
download the ITV Hub app on that device. This also demonstrates the interaction with 
parental settings and controls available on different platforms, which we would also 
suggest that the ICO considers in more detail. 


Against this backdrop, it is hard to see where we are failing children in protecting their 
data and privacy on our service in a way that warrants the enormous disruption and 
cost involved in collecting additional highly sensitive “hard identification” data (such as 
credit card details, passport, driving licence etc) from all our users (over 28 million) or 
requires us to default to “child appropriate” setting, effectively ending all 
personalisation and possibly impacting the range of content we can then show on ITV 
Hub. 


What this code would mean for ITV Hub 


The draft code clearly sets out that the ICO’s preference under this scheme is for all 
online platforms to default to a “child appropriate service” with robust verification then 
allowing adults to opt-into a more bespoke service. This is irrespective of the type of 
service being offered or the intended audience. In reality this sets out a binary choice - 
either service providers will introduce robust age verification from the outset with 
the intention of age gating their service, or a service provider will have to make sure 
their existing service is “child-appropriate” by default. Both options have very 
serious consequences for free to air broadcasters’ online streaming services. 


For ITV Hub, moving to a child-appropriate service would (based on the draft code) 
mean turning off all personalisation. Turning off personalisation would be a huge step 
back away from the type of services consumers have been enjoying for decades and now 
readily come to expect. As well as negatively affecting the consumer experience it would 
also have a huge impact on our ability to sell advertising. 


The draft code also needs to be clearer around what it means by geo-location. For 
streaming services, like ITV Hub, we use various measures (which may include use of IP 
addresses or postcode data) to geo-block our content. If this type of location data has to 
be turned off (or not collected) it would have a significant impact on our ability to 
acquire content for the services, the licensing of which is done on a territorial basis. It 
would also impact our Channel 3 networking arrangements which require 
regionalisation of programming between STV and ITV (Channel 3 content is available on 
the STV Player in Scotland and on ITV Hub in the rest of the UK). To put it simply 
turning off geo-location or collection of location data by default, would mean we would 
be unable to geo-block our service and therefore be unable to put much of our content 
onto the ITV Hub. As a result users would not be able to access that content online, 
consequently negatively affecting our ability to monetise and reinvest in content. 


Through the GDPR, we have in place a robust set of rules around the use of data, for 
example for targeted advertising with obligations around transparency, choice and 
control, but the draft code goes a lot further. In making this “child appropriate by 
default” we would have to consider our approach to all advertising through the lens of a 
child. As a responsible broadcaster/publisher ITV operates a consistency of Advertising 
Code application across broadcast, online/catch up and digital platforms i.e. where a 
programme, programme entity and content is restricted on linear broadcast, the 
identical restriction and compliance regime is enforced across our platforms. Where 
necessary the Advertising Compliance team will view particularly contentious ad 
content to ensure appropriate scheduling and placement is undertaken. As the BCAP 
and CAP Codes are virtually the same and interchangeable, this approach ensures 
compliance across broadcast and non-broadcast platforms. 


The Advertising Codes provide specific restrictions on advertising to children - for 
example in relation to HFSS, alcohol, medicine, slimming, dietary products etc. It 
appears to be the ICO’s position that without full age verification we have to assume that 


all our users are children by default and so cannot serve such advertising. While this is 
an appropriate safeguard for children - and one that we deliver on around our 
children’s content including our CITV portal on the ITV Hub - this simply does not make 
sense when considering that it is primarily adults coming onto ITV Hub and that we 
place such advertising content against editorial content in line with linear placement (so 
we would not place such advertising against content which is of particular appeal to 
children on linear). 


We rely on legitimate interests in relation to personalisation (for both advertising and 
editorial) and give the user the option to control their preferences around 
personalisation (including an option for full opt out of personalisation). We have 
extremely low rates of users choosing not to receive more relevant content. In a 
scenario where we have to introduce “child appropriate by default” and have to treat all 
users of our site as children it is hard to see how personalisation (for both advertising 
and editorial) can continue. 


A move to a “child-appropriate by design” option would also require ITV Hub to create 
multiple experiences and provide various notices and prompts correlating to the age of 
the child on that service, for example around the use and signalling of parental controls. 
The draft code suggests that tailoring of experience can be done based on age self- 
declaration but it is simply not practical or commercially viable to expect online service 
providers to tailor services to cover a multitude of different age ranges. Moreover, 
introducing multiple experiences and options are also likely to prove more confusing for 
the user not less. 


The result is therefore that, if the code remains as drafted, we would be pushed into age 
verifying our users as over 18. On this point, specifically, it is worth noting that the draft 
code in treating children as under 18 is at odds with other regulation and indeed 
implementation of GDPRin the UK. The CAP Code considers a child to be anyone under 
16, not under 18. In addition, GDPR Article 8 states that those aged 16 or over are able 
to give consent for the purposes of GDPR although we note that the Data Protection Act 
2018 actually lowers this age limit to 13. This reduces the parental consent protection 
available in GDPR, which potentially suggests that the UK government considers that 
younger children are more sophisticated in their understanding of data use in the UK. 


A move to introduce robust age verification would see free-to-air streaming services 
having to collect highly sensitive data such as passport, driving licences, credit card 
details or other ‘hard identifiers’. There are four key problems that we see here: 

1) This goes against the principle of data minimisation set out in GDPR and 
underscored elsewhere in the draft code. Indeed it seems odd that to protect 
children online all service providers are being asked to collect highly sensitive 
data from all - perhaps many millions of - citizens and consumers accessing the 
service. This risks entrenching dominance of certain online platforms and 
increasing the severity of any data breaches associated with data collection and 
processing. 

2) As the ICO has acknowledged robust age verification services and tools are not 
yet readily available on the market, and are still very much in their infancy. As 
this code has a statutory footing it is essential that details around verification are 
precise and clear - companies need to know what qualifies as robust verification 
and what would not. 

3) For free-to air ad funded services, collecting data from “hard identifiers” will 
give the very real impression to our audiences that the content they wish to 
watch is no longer free. As well as the not insignificant cost of rolling out 
verification there is a risk that consumers may stop using our service as there is 


evidence that any extra steps in sign up results in user drop-off. This drop-off in 
turn impacts our ability to sell advertising and return investment into 
programming content. As a company trying to build an online business in 
competition with very lightly regulated global incumbents, we are extremely 
concerned by the inevitable commercial impact on us of such a development. 

4) Sucha move will inevitably age gate our service. Rather than a more 
proportionate, personalised approach, the draft code would result in a more 
blunt restriction: children will be excluded from our services (except for CITV) 
and it will negatively impact the ease of adults to access our services and 
content. Again, a drop in users coming onto our services will threaten the 
virtuous circle of reinvestment in original UK content. Everyone will lose with 
little obvious benefit. 


For free to air broadcasters this would put us in an unenviable position, inadvertently 
entrenching the dominance of global US technology platforms and skewing the market 
in favour of paid services (such as Netflix where there is no advertising and where, as 
subscription services, they already have access to credit card details which may be seen 
as a means to deliver robust verification, though again this is left unclear). This is not in 
the long-term interests of UK citizens or consumers. 


What this means for the wider Public Service Broadcasting (PSB) ecology 


Arguably PSB and PSB content is becoming more and not less important in the UK 
against the backdrop of deep division, concerns about the impact of globalization and 
growing unease about disinformation and fake news online. PSB is of particular value to 
UK citizens and consumers in three key areas - contribution to democracy through the 
provision of trusted news, contribution to culture and our contribution to the economy. 
Policymakers seem to recognise this. Indeed, they increasingly want more from PSB - 
more investment out of London, more comprehensive access services and more 
children’s content. 


We are adapting to our new competitive environment - for example by growing our 
online activities, building the ITV Hub into a major online content platform and by 
innovating in advertising, where the combination of mass reach and targeted 
advertising in a brand safe environment gives us a powerful competitive proposition to 
advertisers. Our recent licensing agreement with Amobee, a global digital advertising 
technology company, will accelerate the development of our VOD advertising 
capabilities including an industry standard for VOD (in line with the established linear 
system). 


However, the draft code would seriously undermine our efforts to future-proof our 
business and ensure that we can continue to deliver PSB content. By making us choose 
to either, on the one hand, limit our ability to personalise our online offering and offer 
targeted adverting or, on the other, introduce age verification which goes wholly against 
the GDPR concept of data minimisation and will drive substantial numbers of users 
away from our services, we are caught squarely between competing policy objectives. 
The long-term sustainability of free to air PSBs rests on our ability to evolve and meet 
both consumer and advertiser demands and expectations, in an already highly 
regulated, trusted service for consumer. If policymakers and regulators want us to 
continue to deliver the significant benefits that we do today it is important that we are 
not unfairly hampered in our ability to find ways to encourage users on our sites (for 
example through editorial content personalisation) as well as finding money to reinvest 
in that content (for example through targeted ads). 


It is also worth noting that, whilst the draft code aims to treat all services the same, 
smaller ad-funded PSBs will be disproportionately impacted by this code. Global tech 
companies, also ad-funded, can be seen as a utility service by a large number of 
consumers. Consumers have built online communities on these platforms and are 
increasingly reliant on them for access to information and to engage with work, family 
and friends. Consumers are often locked into these services from an early age and build 
their lives on these platforms. Indeed, despite a series of privacy scandals and criticisms 
over toxic content, users still flock to social media sites (Facebook reported a 9% 
increase in both active daily and monthly and users up to 1.52bn and 2.32bn 
respectively in December 2018, the same year the Cambridge Analytical scandal broke). 


The upshot here is that under this draft code we could actually see large platforms 
becoming a more attractive proposition for advertisers looking to offer targeted 
advertising, and PSB streaming services might well lose out. 


It is hard to comprehend why services offered by PSBs, which are already highly 
regulated safe spaces, might be subject to proposed regulation designed to target 
unregulated global online platforms. In the same way as those platforms are not treated 
or regulated as broadcasters, it is hard to see why we should be subject to rules the 
primary targets of which are so different and expose children to such exponentially 
greater harm. In light of the modest data collection and trusted space that PSBs provide 
we are not the place to start in terms of trying to tackle threats to children’s privacy and 
data. 


Paradoxically, in the case for commercial PSBs in particular, the impact of the draft will 
cut across our ability to meet policy requests for us to make a bigger contribution to 
children’s content, for example. Simply put, all these activities have a cost attached to 
them. In either rolling out a robust verification service, which will also see users drop- 
off from using our service or defaulting to child-appropriate design and curtailing our 
ability to offer a personalised service and targeted advertising, will impact on our ability 
to generate revenue (both in terms of having to divert funds to setting this scheme up or 
in losing ad revenue). Not only are we being asked to do and invest more at a time when 
regulation is shrinking our ability to make money in the first place but the code, by 
seeking to exclude children from ITV Hub (even if that is an unintentional result) means 
that our efforts to improve our offering to children online will be undermined. 


Risk of regulatory overlap 


Content Regulation: The ICO’s remit is around data, however as alluded to above, the 
draft code will, if we go down the route of making our online service child appropriate 
by default, restrict our ability to show the wide range of content that we currently do 
today. The starting point of our service today is that users have to be 16+ to register. At 
this point, users can trigger controls that will restrict access to content that may not be 
appropriate for children. Moving to a child-appropriate by default service however 
would in our view mean that all content on that service should be suitable for children. 
This appears to constitute additional media regulation through the data backdoor. We 
are already subject to very detailed, statutory regulation overseen by Ofcom - there is 
no case at all for yet more regulation of the content services offered by PSBs. 


Alternative approach 


We want the UK to uphold high standards around online data protection and protection 
of children’s data and privacy. For that to happen however we need a proportionate risk 


based approach that recognises the variety of different services, audience needs and 
data processing taking place online. 


Rather than implementing this draft we believe the premise of the code should be 
flipped on its head. Rather than setting out that compliance with GDPR is dependent on 
compliance with the code, the ICO should be encouraged to take a more forensic 
approach, considering the nature and content of the service and potential for harm to 
children in how those services use data including whether online services: 

- have editorial control over their content and whether it is subject to highest 
regulatory standards set by Ofcom and already have in place approaches which 
are adapted to specific user demographics (for example, using linear BARB data 
to inform advertising served to online audiences); 

- have measures in place to protect children on their services including through 
parental controls when it comes to accessing content; 

- the nature of the use of data and whether that is likely to be considered 
particularly invasive, overly aggressive or result in any harm to a user. 


The code needs to incentivise online players to behave better rather than age gating 
sites. By doing the latter we not only risk curtailing and limiting children’s access to 
material, information and content online but could also undermine initiatives around 
media literacy for example in encouraging children to access news from reputable 
sources. 


We would urge the ICO to investigate the types of harms that a child might be exposed to 
on specific sites and take a proportionate risk based approach to addressing these. In 
this way we can tackle the most egregious harms that children face online around the 
use of their data whilst ensuring that both children and adults can continue to have 
access to high-quality content and services via commercial PSB dependant on revenue 
from advertising. 


Finally on a point of process, given the incredible number of services caught by the daft 
code and significant impact this code will have on those services we believe it is remiss 
that the ICO has not undertaken a full impact assessment. We also believe that the 
consultation timescale - six weeks - was far too short. While clearly the ICO is the 
relevant data regulator, the area of online regulation cuts across a number of different 
bodies, with significant potential to overlap into other areas of regulation as well. Due 
process is needed to navigate this carefully and avoid dual, perhaps even contradictory, 
regulatory regimes that would be confusing to both business and citizens. 
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